Yes they can! For example, try http://whatever.bitmailendavkbec.onion which is the Bitmessage onion service with an arbitrary subdomain.
Not that the subdomain is not transmitted between the Tor client and the onion server. It's the browser that sends the full host (including the subdomain) to the webserver in the request's Host header, so protocols othe ...
Apache doesn't run through Tor. It is a service that listens on the ip address(es) and port(s) you specify in its config file. If you want to configure Apache to host only hidden services, then you limit your listening IP address to 127.0.0.1:
After that, in the VirtualHost block, you put the onion address in the ServerName. For example:...
HiddenServicePort corresponds to the most recent HiddenServiceDir entry.
HiddenServicePort VIRTPORT [TARGET]
Configure a virtual port VIRTPORT for a hidden service. You may use this option multiple times; each time applies to the service using the most recent
HiddenServiceDir. By default, this option maps the virtual port to the same port on ...
It is the same as hosting a regular website, but it is routed through and only reachable through the tor network. You setup a website using the ngnix (reccomended for security) web server. You set it up to only listen to your localhost (127.0.0.1) so it is not reachable by the regular web. You then setup a tor server and configure it to generate a .onion ...
Your calculation is not fully correct. The hidden service address is encoded in Base32, which means there are 32 characters available. So there are 32^16=1.208925819614629174706176×10^24 addresses available. Even if you assume that someone has 10 billion machines and each machine needs a second for a test the whole experiment would need nearly four million ...
A hidden service is most useful when you wish to provide a service while trying to remain anonymous. They are also useful for users testing .onion reachability from their Tor Browser. Finally, they can be used to encourage Tor use, while incidentally limiting the visitors to the service to those capable of running Tor or using a .onion gateway site.
A captcha (i.e., reCAPTCHA) that must be input for every post.
It's good for all kinds of spam, not just spam from Tor users.
An alternative method could be to simply block Tor users from posting (but allow them to read).
7100 sounds about right for the number of hidden web services that are up at any given time. It actually sounds a bit high.
The 30K from Tor metrics are the aggregate data from HSDirs. The fact that a hidden service is hosted/registered on the Tor network does not mean that it points to an actual live server.
'Scanning' all possible addresses is not the ...
But traditionally for a regular non-onion site we usually buy hosting.
Can I buy hosting for a onion site?
Absolutely! You can pay for a VPS or a managed server or even co-locate your own server.
Here are some things to keep in mind:
If you use a VPS, what will keep you provider from viewing what's in your storage?
If you use a managed server or you ...
To my knowledge, there is currently no way to avoid that your key, at least for a short time, is on your server in cleartext.
However, the next generation onion services (V3) will allow you to do that once ticket #18098 (offline keys) has been implemented. Beware that the addresses differ from V2 addresses and you'll have to create a new onion address.
If your guard node is failing, you could try using a different guard node if you really really want to:
How to change the entry node?
But according to this answer, you shouldn't have to:
Should I choose a new guard if the network is overloaded?
There are security implications to changing your guard node:
Why is a longer guard rotation period with fewer ...
Could they have made a scan of all the .onion websites in 3 hours?
It is impossible in the way of brute-force attack. Because you can not check all possible variants of .onion's names. It is too many at the First and at the Second - Tor's bandwidth simply will do not give you a chance for this. You must remember, it is not an Internet, it is much-much ...
Assuming the program that generated the hostname for you is working properly, it should give you 2 files, once called hostname and the other called private_key. Put the 2 files in one folder, for example /home/user/tor_private. The next step is to add a reference to this folder in your torrc file. Open your torrc file (it is in /etc/tor/torrc when you use ...
Running a Tor relay, a Tor Browser and a web server on the same host does not make either of them more vulnerable or identifiable. But running a relay means that your IP is publicly advertised, which could get any internet-facing service on your host more 'attention' than it would get otherwise.